From: Tom Rini <trini@konsulko.com>
To: "Ying-Chun Liu (PaulLiu)" <paul.liu@linaro.org>
Cc: u-boot@lists.denx.de, Tom Cherry <tomcherry@google.com>
Subject: Re: [PATCH 1/1] lib/vsprintf.c: fix integer overflow in vsprintf
Date: Tue, 15 Aug 2023 10:42:27 -0400 [thread overview]
Message-ID: <20230815144227.GI3630934@bill-the-cat> (raw)
In-Reply-To: <20230309021221.306044-2-paul.liu@linaro.org>
[-- Attachment #1: Type: text/plain, Size: 978 bytes --]
On Thu, Mar 09, 2023 at 10:12:21AM +0800, Ying-Chun Liu (PaulLiu) wrote:
> From: Tom Cherry <tomcherry@google.com>
>
> vsnprintf_internal() adds 'size' to 'buf' and vsprintf() sets 'size'
> to 'INT_MAX' which can overflow. This causes sprintf() to fail when
> initializing the environment on 8GB.
>
> Instead of using 'INT_MAX', we use SIZE_MAX - buf, which is the
> largest possible string that could fit without overflowing 'size'.
>
> Signed-off-by: Tom Cherry <tomcherry@google.com>
> [ Paul: pick from the Android tree. Rebase to the upstream ]
> Signed-off-by: Ying-Chun Liu (PaulLiu) <paul.liu@linaro.org>
> Cc: Tom Rini <trini@konsulko.com>
> Link: https://android.googlesource.com/platform/external/u-boot/+/43aae5d4415e0f9d744fb798acd52429d09957ce
So, this link here leads back to
https://issuetracker.google.com/issues/200479053 which isn't public.
Rasmus followed up and asked pointed questions, that weren't followed up
on.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
next prev parent reply other threads:[~2023-08-15 14:42 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-09 2:12 [PATCH 0/1] lib/vsprintf.c: fix integer overflow in vsprintf Ying-Chun Liu (PaulLiu)
2023-03-09 2:12 ` [PATCH 1/1] " Ying-Chun Liu (PaulLiu)
2023-03-09 9:45 ` Rasmus Villemoes
2023-08-15 14:42 ` Tom Rini [this message]
2023-08-15 15:33 ` Paul Liu
2023-08-17 23:49 ` Tom Cherry
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230815144227.GI3630934@bill-the-cat \
--to=trini@konsulko.com \
--cc=paul.liu@linaro.org \
--cc=tomcherry@google.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox